Obligations United States Kentucky
What a Kentucky business has to have in writing
Kentucky's written-policy load sits mostly in two places: a comprehensive consumer privacy act that took effect January 1, 2026, and a thick stack of statutory postings and registers that even a small employer has to keep on the wall. Kentucky OSH runs an OSHA-approved State Plan covering both private and public workplaces.
Insurers and other Department of Insurance licensees with 50 or more people keep a written information security program and certify it to the commissioner each February, and any vendor holding personal data for a Kentucky public agency owes contractual safeguards plus a 72-hour breach report.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
KentuckyHandbook 2026acknowledged by name
Kentucky on Recordwith AllyMatter
Cover Kentucky the Modern WayEvery policy Kentucky makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Kentucky on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Kentucky rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Notification of computer security breachAI-compiledKRS 365.732Any person or business entity conducting business in Kentucky that holds computerized personally identifiable information about Kentucky residents; entities covered by Gramm-Leach-Bliley or HIPAA are excludedDistribute
Notice
Tell affected Kentucky residents about a breach of unencrypted personal information in the most expedient time possible and without unreasonable delay, by written, electronic or substitute notice. Notify the national consumer reporting agencies when more than 1,000 people are affected. A business that maintains its own written breach-notification procedures inside an information security policy may follow those procedures instead. Kentucky sets no Attorney General notice requirement and no fixed day count.
From the first employee
Kentucky Attorney General; private civil action
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Personal information security and breach investigation procedures (public agencies and their vendors)AI-compiledKRS 61.931 to 61.934Any nonaffiliated third party that is given access to, or holds, personal information on behalf of a Kentucky state agency, local government, school district or public postsecondary institutionWrite
Written program
Implement, maintain and update written security and breach investigation procedures at least as stringent as the state's own, as a term of the agency contract; notify the contracting agency within 72 hours of determining a breach, cooperate in the investigation, and share the cost of notification as the contract apportions it.
From the first employee
Contracting public agency; Commonwealth Office of Technology sets executive-branch policy; Department for Local Government for local units
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Kentucky Consumer Data Protection ActAI-compiledKRS 367.3611 to 367.3629 (2024 Ky. Acts ch. 72, HB 15)Businesses that operate in Kentucky or target Kentucky residents and, in a calendar year, control or process personal data of 100,000+ consumers, or of 25,000+ consumers while drawing more than half of gross revenue from selling personal data; government bodies, financial institutions and Gramm-Leach-Bliley data are exemptWrite
Written policy
Publish a clear privacy notice listing the categories of personal data processed and shared, the purposes, the categories of third parties, and how to exercise rights; get opt-in consent before processing sensitive data, which includes biometric and genetic data; run and document a data protection impact assessment for targeted advertising, data sales, certain profiling and sensitive-data processing, and hand it to the Attorney General on request; answer access, correction, deletion, portability and opt-out requests within 45 days and run an appeal process; put a written contract in place with every processor.
From the first employee
Kentucky Attorney General (exclusive; 30-day cure period, up to $7,500 per continued violation, no private right of action)
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Kentucky Occupational Safety and Health Act (Kentucky OSH State Plan)AI-compiledKRS Chapter 338; 803 KAR Chapter 2All private-sector and state and local government employers in KentuckyWrite
Written program
Keep the workplace free of recognized hazards and comply with the standards the Kentucky Occupational Safety and Health Standards Board adopts, which are the federal OSHA standards plus Kentucky-specific rules. Make, keep and preserve the injury, illness and exposure records the Department of Workplace Standards prescribes, and post the notices that keep employees informed of their rights under the chapter, including the Kentucky OSH poster. Kentucky adds no general written safety-program mandate beyond the federal-equivalent standards.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards (Kentucky OSH); Kentucky Occupational Safety and Health Review Commission
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Insurance data security lawAI-compiledKRS 304.3-750 to 304.3-768 (2022 Ky. Acts ch. 149, HB 474)Persons licensed or authorized to do insurance business in Kentucky; licensees with fewer than 50 employees, including independent contractors, are exemptCertify
Certification
Build and keep a comprehensive written information security program based on a documented risk assessment, name someone accountable for it, oversee third-party service providers, set retention and destruction schedules, and reassess key controls at least annually. Keep a written incident response plan. Insurers domiciled in Kentucky file a written compliance certification with the commissioner by February 15 each year and hold the supporting records five years. Report a cybersecurity event to the commissioner within three business days of determining it happened.
50+ employees
Kentucky Department of Insurance (commissioner)
Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Adoption leave and parity with birth-parent benefitsAI-compiledKRS 337.015Every Kentucky employerWrite
Written policy
On a written request, grant an employee adopting a child under ten at least six weeks of reasonable personal leave, or the longer period the employer already gives birth parents. If the employer gives paid leave or other benefits to birth parents, give adoptive parents the same type, amount and duration, which in practice means the parental leave policy has to name both. Adoptions by stepparents, blood relatives, fictive kin and existing foster parents are excluded. Kentucky has no statewide paid sick leave law.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Statutory workplace postingsAI-compiledKRS 337.325; KRS 337.433; KRS 338.161(2); KRS 341.400; KRS 344.040(3)(b); KRS 339.400Every Kentucky employer, with each posting keyed to the statute that creates itPost
Posting
Post, in a conspicuous and accessible place, the summaries of the wage and hour laws and regulations, an abstract of the Kentucky equal pay statutes, the Kentucky OSH notice, the unemployment insurance statements the Education and Labor Cabinet prescribes, the pregnancy anti-discrimination and accommodation notice, and, where minors are employed, the child labor abstract and hours notice. The state supplies the wage and hour and equal pay abstracts free on request.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards; Kentucky Commission on Human Rights
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Kentucky equal pay act (wage discrimination and posting)AI-compiledKRS 337.420 to 337.433Employers covered by the Kentucky equal pay statutesPost
Posting
Pay men and women the same wage rate for comparable work under similar conditions, and keep an abstract or copy of the equal pay statutes posted conspicuously where employees work. Kentucky does not require salary ranges in job postings and has no general pay-range disclosure law.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration and annual reportAI-compiledKRS Chapter 14A; KRS Chapter 271B (corporations); KRS Chapter 275 (LLCs)Any corporation, LLC, partnership or nonprofit formed in or doing business in Kentucky, and anyone using an assumed nameFile
Filing / record
File formation or foreign-qualification documents with the Secretary of State, keep a principal office and a Kentucky registered agent and registered office, file a statement of change when any of those move, record a certificate of assumed name for any DBA, and file the annual report by June 30 each year after formation or the entity goes into bad standing.
From the first employee
Kentucky Secretary of State, Business Filings
Food establishment permit and certified food protection manager (Kentucky food code)AI-compiled902 KAR 45:005; KRS 217.125Food service establishments, retail food stores, mobile units and temporary food operationsCertify
Certification
Hold a current permit from the local health department, pass routine inspections and correct violations within the time the inspection report sets. Kentucky replaces the FDA Food Code's demonstration-of-knowledge option, so the person in charge has to be a certified food protection manager who passed an accredited exam or a local health department class.
From the first employee
Cabinet for Health and Family Services, Department for Public Health; local health departments
Electrical contractor, master electrician and electrician licensingAI-compiledKRS 227A.010 to 227A.140; 815 KAR 35:060Anyone performing or holding out as performing electrical contracting, master electrician or electrician work in KentuckyCertify
Certification
Hold the right state license before doing or advertising electrical work, pass the approved examination, keep a licensed master electrician affiliated with the contracting business, carry the required insurance, and renew biennially. State licensing supersedes local electrician ordinances. Kentucky does not license general contractors at the state level.
From the first employee
Kentucky Department of Housing, Buildings and Construction (Public Protection Cabinet)
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Kentucky Pregnant Workers Act (accommodation, written notice and posting)AI-compiledKRS 344.040(1)(c) and 344.040(3); KRS 344.030(2) (2019 Ky. Acts ch. 200, SB 18)Employers with 15 or more employees in Kentucky for 20 or more calendar weeks in the current or preceding year, for accommodation of an employee's own pregnancy-related limitationsDistribute
Notice
Give every new employee written notice at hire of the right to be free from pregnancy discrimination and to reasonable accommodations, and post that same written notice conspicuously where employees can reach it. Run a timely, good-faith interactive process on accommodation requests, including space and time to express breast milk, and do not force an employee onto leave when another accommodation would work.
15+ employees
Kentucky Commission on Human Rights; private civil action
Child labor register and posted hoursAI-compiledKRS 339.400; KRS 339.230; 803 KAR 1:100Any employer of minors under 18File
Filing / record
Keep a separate register for employees under 18 with names, ages, addresses, daily start and stop times and meal period times, and post an abstract of the child labor statutes, the list of occupations prohibited to minors, and a notice of the working hours required of them each day. Open the register to school pupil personnel directors, probation officers and Education and Labor Cabinet inspectors on request.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards
Employer wage and hour recordsAI-compiledKRS 337.320Every employer subject to the Kentucky wage and hour lawFile
Filing / record
Keep for each employee a record of the amount paid each pay period, the hours worked each day and week, and any other information the commissioner requires; hold the records on file at least one year and open them to inspection by the Department of Workplace Standards.
From the first employee
Kentucky Education and Labor Cabinet, Department of Workplace Standards
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Kentucky on top
Small businessFederal + industry, with Kentucky on topConstruction contractorsFederal + industry, with Kentucky on topHealthcare practicesFederal + industry, with Kentucky on topFood and beverage businessesFederal + industry, with Kentucky on topTax and accounting firmsFederal + industry, with Kentucky on topRegistered investment advisersFederal + industry, with Kentucky on topInsurance agenciesFederal + industry, with Kentucky on topRetail and e-commerceFederal + industry, with Kentucky on topTrucking and logistics carriersFederal + industry, with Kentucky on topNonprofitsFederal + industry, with Kentucky on topFederal contractorsFederal + industry, with Kentucky on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Kentucky Legislature - KRS 365.732Kentucky Legislature - 2014 Acts ch. 84 (HB 232)Kentucky Legislature - KRS 367.3611 (definitions and thresholds)Kentucky Legislature - KRS 367.3627 (Attorney General enforcement and cure period)Kentucky Legislature - KRS Chapter 367 index (KRS 367.3617 privacy notice, 367.3621 impact assessment)Kentucky Legislature - KRS 61.932Kentucky Legislature - KRS 61.933 (notification of breach)Kentucky Legislature - KRS 304.3-756 (written information security program and annual certification)Kentucky Legislature - KRS 304.3-752 (fewer than 50 employees exemption)Kentucky Legislature - KRS 304.3-760 (three-business-day cybersecurity event notice)Kentucky Legislature - KRS 338.031 (obligations of employers)Kentucky Legislature - KRS 338.161 (records and posting of notices)OSHA - Kentucky State PlanKentucky Legislature - KRS 337.325 (posting wage and hour summaries)Kentucky Legislature - KRS 341.400 (notice to workers)Kentucky Legislature - KRS 337.433 (posting of law)Kentucky Legislature - KRS Chapter 337 indexKentucky Legislature - KRS 337.015Kentucky Legislature - KRS 344.040Kentucky Legislature - KRS 344.030 (15-employee threshold for pregnancy accommodation)Kentucky Legislature - SB 18 of 2019 as enactedKentucky Legislature - KRS 339.400Kentucky Legislature - 803 KAR 1:100 (child labor)Kentucky Legislature - KRS 337.320Kentucky Secretary of State - Business Filings InformationKentucky Legislature - KRS Chapter 14A (Kentucky Business Entity Filing Act)Kentucky Legislature - 902 KAR 45:005 (Kentucky food code)Kentucky Legislature - KAR Title 902 indexKentucky Legislature - KRS 227A.020 (prohibitions and local programs)Kentucky Legislature - KRS 227A.060 (qualifications for licensure)Kentucky Legislature - 815 KAR 35:060 (licensing of electrical contractors)